Entities covered and obligations
- Administrations, local authorities, public institutions and operators of critical infrastructure.
- Adoption of an information systems security policy and appointment of a dedicated officer.
- Notification of security incidents to the national authority within the regulatory time limits.
- Periodic security audits carried out by qualified service providers.
Governance
- The national cybersecurity authority coordinates the framework, issues directives and may order emergency measures.
- Cybersecurity service providers are subject to qualification.
- Breaches expose the entity to administrative penalties, without prejudice to criminal prosecution.
Key articles
A lawyer's points to watch
- The law operates alongside Law 09-08: an incident affecting personal data triggers two separate obligations.
- Security and audit clauses must be included in outsourcing and hosting contracts.
- Keep a record of incident notifications: it demonstrates the organisation's diligence.
The English text on this page, including the quoted articles, is an unofficial translation. Information sheet prepared by Maître Lahfaia Law Firm, Rabat. It does not constitute legal advice. Only the text published in the Official Bulletin of the Kingdom of Morocco is authoritative; the articles cited may have been amended since this sheet was written.